iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

76
votes
2answers
35k views

IPTABLES - Limit rate of a specific incoming IP

I do not wish to limit the rate of a specific service. My goals is to limit rate based solely on the incoming IP address. For example using a pseudo-rule: john.domain.local (192.168.1.100) can only ...
44
votes
10answers
186k views

How to start/stop iptables on Ubuntu?

How can I start/stop the iptables service on Ubuntu? I have tried service iptables stop but it is giving "unrecognized service". Why is it doing so? Is there any other method?
41
votes
5answers
4k views

Why is tampering with the TTL of IP dangerous?

I've been reading the iptables man-page (light bedtime reading) and i came across the 'TTL' target, but it warns: Setting or incrementing the TTL field can potentially be very dangerous and ...
40
votes
4answers
115k views

How can I port forward with iptables?

I want connections coming in on ppp0 on port 8001 to route to 192.168.1.200 on eth0 on port 8080 I've got these two rules -A PREROUTING -p tcp -m tcp --dport 8001 -j DNAT --to-destination ...
38
votes
13answers
15k views

iptables Tips & Tricks

I'm sure Linux sysadmins are quite familiar with iptables, the userland interface to the netfilter packet-filtering framework. Now, this "Question" is meant to be a Community Wiki for collecting ...
33
votes
9answers
14k views

Why not block ICMP?

I think I almost have my iptables setup complete on my CentOS 5.3 system. Here is my script... # Establish a clean slate iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT ...
27
votes
5answers
8k views

Debugger for Iptables

I'm looking for an easy way to follow a packet through the iptables rules. This is not so much about logging, because I don't want to log all traffic (and I only want to have LOG targets for very few ...
27
votes
7answers
22k views

Denyhosts vs fail2ban vs iptables- best way to prevent brute force logons?

I'm setting up a LAMP server and need to prevent SSH/FTP/etc. brute-force logon attempts from succeeding. I've seen many recommendations for both denyhosts and fail2ban, but few comparisons of the ...
26
votes
4answers
14k views

REJECT vs DROP when using iptables

Is there any reason why I would want to have iptables -A INPUT -j REJECT instead of iptables -A INPUT -j DROP
26
votes
3answers
35k views

Windows equivalent of iptables?

Dumb question: Is there an equivalent of iptables on Windows? Could I install one via cygwin? The real question: how can I accomplish on Windows what I can accomplish via iptables? Just looking for ...
25
votes
1answer
1k views

Minimal rate and default class problem for HTB

I have some doubts about a HTB structure I'm using. My aim is to limit the download and upload speed of users in a local network. Each user of the network has a personal list of domains with a down ...
24
votes
6answers
3k views

Hardware Firewall Vs. Software Firewall (IP Tables, RHEL)

TL;DR My hosting company says IP Tables is useless and doesn't provide any protection. Is this BS? I have two, co-located servers. Yesterday my DC company contacted me to tell me that because I'm ...
24
votes
3answers
18k views

iptables port redirect not working for localhost

I want to redirect all traffic from port 443 to the internal port 8080. I'm using this config for iptables: iptables -t nat -I PREROUTING --source 0/0 --destination 0/0 -p tcp ...
21
votes
1answer
2k views

How can I block all traffic *except* Tor?

On a Linux system, is there a way to block all in and outbound traffic unless it passes through the Tor network. This includes any form of IP communication, not just TCP connections. For example I ...
21
votes
2answers
8k views

Iptables, what's the difference between -m state and -m conntrack?

What's the practical difference between: iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT and iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT Which one is ...
18
votes
2answers
34k views

Allowing FTP with IPTables

My current scenario involves allowing various rules, but I need ftp to be accessible from anywhere. The OS is Cent 5 and I am using VSFTPD. I can't seem to get the syntax correct. All other rules ...
18
votes
2answers
27k views

How to reload default Mac OSX routing table without rebooting

Greetings, I'm using vpnc for a VPN client. I'm also doing some tricky things with route to make sure I can still access my local network, etc. etc. (the particulars here are not very important). ...
17
votes
5answers
5k views

Use IPtables or null route for blacklisting about 1 million IP addresses?

I've come across a situation where a client needs to blacklist a set of just under 1 million individual IP addresses (no subnets), and network performance is a concern. While I would conjecture that ...
17
votes
2answers
12k views

IPTables only allow localhost access

I have struggled throughout the years to get a solid understanding on iptables. Any time I try and read through the man pages my eyes start to glaze over. I have a service that I only want to allow ...
17
votes
5answers
35k views

iptables equivalent for mac os x

I want to forward requests from 192.168.99.100:80 to 127.0.0.1:8000. This is how I'd do it in linux using iptables: iptables -t nat -A OUTPUT -p tcp --dport 80 -d 192.168.99.100 -j DNAT ...
16
votes
7answers
16k views

Force local IP traffic to an external interface

I have a machine with several interfaces that I can configure as I want, for instance: eth1: 192.168.1.1 eth2: 192.168.2.2 I would like to forward all the traffic sent to one of these local ...
16
votes
2answers
8k views

Why is our firewall (Ubuntu 8.04) rejecting the final packet (FIN, ACK, PSH) with a RST

Background, for a long time we have had problems with our firewall that sometimes keep HTTP requests hanging partially loaded until TCP times out. After tracing the traffic on the firewall I noticed ...
15
votes
6answers
25k views

How to Unban an IP properly with Fail2Ban

I'm using Fail2Ban on a server and I'm wondering how to unban an IP properly. I know I can work with IPTables directly: iptables -D fail2ban-ssh <number> But is there not a way to do it with ...
15
votes
12answers
48k views

Using Linux IPTables, How to block torrents or any P2P protocols?

At our institution we had connected 300+ computers to different LAN's with Internet. Included here are Officies LAN, and Internet Laboratory for students. And we want to Control Torrents or any P2P ...
14
votes
3answers
468 views

What are the IPV6 reserved address spaces?

I'm converting my good old IPV4 based iptables firewall script and would like to substitute the CLASS A/B/C/D/E reserved address spaces to the ones found in IPV6. My goal is to deny any packets that ...
14
votes
3answers
2k views

Automatically modify iptables based on Apache log data to block badly behaved clients

Is there any tool on Linux to automatically modify iptables so as to block a troublesome client based on an analysis of the Apache log? I help run a site that sometimes get overwhelmed by requests ...
13
votes
5answers
948 views

Managing iptables rules in Linux

I have a lot of rules for my iptables setup (routing, ssh bans etc) I also picked up a list of IP's to ban from here http://blacklist.linuxadmin.org and now its getting really complicated. My ...
13
votes
4answers
3k views

iptables management tools for large scale environment

The environment I'm operating in is a large-scale web hosting operation (several hundred servers under management, almost-all-public addressing, etc -- so anything that talks about managing ADSL links ...
12
votes
3answers
33k views

Iptables: How to allow only one ip through specific port?

How can I on my ubuntu server, in Iptables only allow one IP adress on a specific port? Thanks
12
votes
2answers
13k views

Does traceroute use UDP or ICMP or both?

When I do a trace on the www.google.com domain from my laptop, am I using icmp or udp ? I thought it was icmp type 11 but while searching for something else I came across rules where icmp type 30 was ...
12
votes
3answers
1k views

Can you recommend a good intro to iptables?

I have to setup a firewall on a Linux server (all my previous experience is with Windows). My rules are meant to be pretty simple - forbid all, allow some ports with all, allow some ports for specific ...
12
votes
2answers
905 views

What is the difference between securing a linux box using hosts.[allow|deny] vs iptables?

As the title states, I have a linux box. As far as I can tell I can use hosts.allow / hosts.deny or iptables to secure. What's the difference? Is there another mechanism that can be used?
12
votes
1answer
10k views

iptables: difference between NEW, ESTABLISHED and RELATED packets

Part of a firewall on a server : iptables -A INPUT -p tcp --dport 22 -m state NEW --state -m recent --set iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 100 ...
11
votes
3answers
6k views

How to turn iptables stateless?

I'm running a Linux server that - from time to time - faces heavy load and the conntrack table overflows. Since it's iptables firewall ruleset is very simple I'd like to turn it to stateless mode. I ...
11
votes
6answers
1k views

What is the best solution for traffic control in a large system (ca. 2000 users)?

following situation: We're a group of students administering the internet connection for the local resident halls, with a total of about 2000 end users. We have a traffic point system, every MB down- ...
10
votes
2answers
2k views

linux command to prevent dos attack by using netstat and iptables

I want to DROP more than 200 requests per ip to prevent ddos attack. this is command that i used to detect requests count per ip : netstat -alpn | grep :80 | awk '{print $5}' |awk -F: '{print ...
10
votes
3answers
5k views

Cannot Set UID on Shell Scripts

Can anyone help me find out what is going on here? I have some rules set up tracking packet counts. When I run the following script as root: #!/bin/bash iptables -t mangle -xnvL I get the output ...
10
votes
2answers
12k views

How can I block all but three ports in Ubuntu?

How can I block all ports except for 1962, 999, 12020? One port for SSH and two others for a kind of script. So, it's necessary to allow outgoing on these ports, right? My iptables: # Generated by ...
10
votes
4answers
15k views

Good iptables starting rules for a webserver?

I am installing a new centos 5.4 server and I would like to have a set of clean rules for mu iptables to startup. What would be the good rules to start with? Is this a good starting point : # ...
10
votes
2answers
6k views

Do I need seperate iptables rule for ipv6 address?

On my debian 5.0 server, I setup some iptables rules like below: ACCEPT tcp -- eee.fff.ggg.hhh aaa.bbb.ccc.ddd tcp dpt:80 DROP tcp -- 0.0.0.0/0 aaa.bbb.ccc.ddd ...
10
votes
6answers
19k views

Delete a iptables chain with its all rules

I have a chain appended with many rules like: > :i_XXXXX_i - [0:0] > -A INPUT -s 282.202.203.83/32 -j i_XXXXX_i > -A INPUT -s 222.202.62.253/32 -j i_XXXXX_i > -A INPUT -s ...
10
votes
5answers
14k views

A secure, standard iptables rule-set for a basic HTTP(s) webserver

I have been trying to put together a basic server iptables script that will work for most sites just running a basic webserver using HTTP(S) and SSH (ports 80, 443, & 22). After all, most VPS only ...
10
votes
1answer
537 views

iptables not allowing mysql connections to aliased ips?

I have a fairly simple iptables firewall on a server that provides MySQL services, but iptables seems to be giving me very inconsistent results. The default policy on the script is as follows: ...
10
votes
2answers
359 views

Counting bandwidth from a Docker container

I'm trying to figure out how to track bandwidth coming from a Docker container. Normally I use --uid-owner as mark to keep track of bandwidth usage for a given user. However, even when I run all the ...
9
votes
3answers
268 views

advantages in closing a port where no services are running

Are there advantages in closing a port where no services are running? What do I gain in terminating a connection at iptables level instead of what does it next (I guess OS).
9
votes
2answers
15k views

How to enable iptables (instead of firewalld) services on RHEL 7 and Fedora 18?

The newest fedora has firewalld as new firewall aplication. I liked old iptables services. I want them back but have no idea how to do that. I have tried : systemctl disable firewalld.service ...
9
votes
5answers
3k views

Managing parallel rules for ipv4 and ipv6 iptables?

We've recently started experimenting with IPv6, and one of the first issues we're having to contend with is dealing with a completely separate set of firewall (Linux iptables/ip6ables) rules for the ...
9
votes
1answer
1k views

Limit ICMP Per Source IP with IPTables

I have mistakenly thought that the limit module is per source ip, but it appears to be based on all requests: 577 36987 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 ...
9
votes
2answers
189 views

How can I write automated tests for iptables?

I am configuring a Linux router with iptables. I want to write acceptance tests for the configuration that assert things like: traffic from some guy on the internet is not forwarded, and TCP to port ...
8
votes
5answers
13k views

iptables rules to allow HTTP traffic to one domain only

I need to configure my machine as to allow HTTP traffic to/from serverfault.com only. All other websites, services ports are not accessible. I came up with these iptables rules: #drop everything ...